CVE-2010-0806
Microsoft Internet Explorer Use-After-Free Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 3 June 2026). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka "Uninitialized Memory Corruption Vulnerability."
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 82.24% probability · 100th percentile
- Public exploits
- 2 in Exploit-DB · verified · first 10 March 2010
- CISA KEV
- Listed 20 May 2026 · due 3 June 2026
- Weakness
- CWE-399, CWE-416
- Affected
- microsoft/internet explorer
- Source
- secure@microsoft.com
EPSS 82.2% since 27 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
CISA notes
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://learn.microsoft.com/en-us/security-updates/securityadvisories/2010/981374 ; https://nvd.nist.gov/vuln/detail/CVE-2010-0806
Public exploits (2)
Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.
| EDB-ID | Title | Type | Published | Verified |
|---|---|---|---|---|
| EDB-16590source ↗ | Microsoft Internet Explorer - DHTML Behaviour Use-After-Free (MS10-018) (Metasploit)windows · Metasploit | remote | 14 December 2010 | yes |
| EDB-11683source ↗ | Microsoft Internet Explorer - 'iepeers.dll' Use-After-Free (Metasploit)windows · Trancer | remote | 10 March 2010 | yes |
References
- http://blogs.technet.com/msrc/archive/2010/03/09/security-advisory-981374-released.aspxBroken Link
- http://osvdb.org/62810Broken Link
- http://secunia.com/advisories/38860Vendor Advisory
- http://www.kb.cert.org/vuls/id/744549Patch, US Government Resource
- http://www.microsoft.com/technet/security/advisory/981374.mspxBroken Link, Patch, Vendor Advisory
- http://www.securityfocus.com/bid/38615Broken Link
- http://www.us-cert.gov/cas/techalerts/TA10-068A.htmlUS Government Resource
- http://www.us-cert.gov/cas/techalerts/TA10-089A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2010/0567Vendor Advisory
- http://www.vupen.com/english/advisories/2010/0744Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/56772Third Party Advisory, VDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8446Broken Link
- http://blogs.technet.com/msrc/archive/2010/03/09/security-advisory-981374-released.aspxBroken Link
- http://osvdb.org/62810Broken Link
- http://secunia.com/advisories/38860Vendor Advisory
- http://www.kb.cert.org/vuls/id/744549Patch, US Government Resource
- http://www.microsoft.com/technet/security/advisory/981374.mspxBroken Link, Patch, Vendor Advisory
- http://www.securityfocus.com/bid/38615Broken Link
- http://www.us-cert.gov/cas/techalerts/TA10-068A.htmlUS Government Resource
- http://www.us-cert.gov/cas/techalerts/TA10-089A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2010/0567Vendor Advisory
- http://www.vupen.com/english/advisories/2010/0744Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/56772Third Party Advisory, VDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8446Broken Link
- https://learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-0806US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.